{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13719", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-06-29T14:10:37.534Z", "datePublished": "2026-09-30T11:06:38.172Z", "dateUpdated": "2026-09-30T14:29:13.891Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "mon3m"}], "datePublic": "2026-09-29T07:44:02.000Z", "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "metrics": [{"cvssV3_1": {"baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-200", "description": "CWE-200", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-30T13:05:14.113Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-13719"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "Alert rules in restricted folders disclosed via the alert rules list API"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T14:29:01.284869Z", "id": "CVE-2026-13719", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T14:29:13.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13719", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T14:29:01.284869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T14:29:10.273Z"}}], "cna": {"title": "Alert rules in restricted folders disclosed via the alert rules list API", "source": {"discovery": "BUG_BOUNTY"}, "credits": [{"lang": "en", "type": "finder", "value": "mon3m"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "Grafana", "product": "Grafana Enterprise", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.12", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.10", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.7", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Grafana", "product": "Grafana OSS", "versions": [{"status": "affected", "version": "12.3.0", "versionType": "semver", "lessThanOrEqual": "12.3.11"}, {"status": "affected", "version": "12.4.0", "lessThan": "12.4.12", "versionType": "semver"}, {"status": "affected", "version": "13.0.0", "lessThan": "13.0.10", "versionType": "semver"}, {"status": "affected", "version": "13.1.0", "lessThan": "13.1.7", "versionType": "semver"}, {"status": "affected", "version": "13.2.0", "lessThan": "13.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-29T07:44:02.000Z", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2026-13719", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-30T13:05:14.113Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13719", "state": "PUBLISHED", "dateUpdated": "2026-09-30T14:29:13.891Z", "dateReserved": "2026-06-29T14:10:37.534Z", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "datePublished": "2026-09-30T11:06:38.172Z", "assignerShortName": "GRAFANA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}, {"lessThan": "13.1.7", "status": "affected", "version": "13.1.0", "versionType": "semver"}, {"lessThan": "13.2.3", "status": "affected", "version": "13.2.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed."}], "id": "CVE-2026-13719", "lastModified": "2026-09-30T17:23:08.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13719", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T14:29:01.284869Z", "version": "2.0.3"}}]}, "published": "2026-09-30T11:16:43.757", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-13719"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-863"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API", "id": "2543885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543885"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-863", "details": ["A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-13719", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:5", "fix_state": "Not affected", "package_name": "rhceph/rhceph-5-dashboard-rhel8", "product_name": "Red Hat Ceph Storage 5"}, {"cpe": "cpe:/a:redhat:ceph_storage:6", "fix_state": "Not affected", "package_name": "rhceph/rhceph-6-dashboard-rhel9", "product_name": "Red Hat Ceph Storage 6"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph-ci/grafana", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-30T11:06:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-13719\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-13719\nhttps://grafana.com/security/security-advisories/cve-2026-13719"], "statement": "This Moderate impact flaw allows an authenticated Grafana user to retrieve alert-rule configurations from folders they cannot read by querying the alert-rule list API. Disclosure is limited to the organization\u2019s rule configurations; data source credentials are not exposed. Red Hat products shipping Grafana builds with the vulnerable behavior are affected.", "threat_severity": "Moderate"}